whistle 2.10.9 → 2.10.10

package/biz/webui/lib/index.js

@@ -35,6 +35,7 @@ var uploadUrlencodedParser = bodyParser.urlencoded(UPLOAD_PARSE_CONF);
 var uploadJsonParser = bodyParser.json(UPLOAD_PARSE_CONF);
 var GET_METHOD_RE = /^get$/i;
 var WEINRE_RE = /^\/weinre\/.*/;
+var IMPORT_CGI = '/cgi-bin/import-remote';
 var ALLOW_PLUGIN_PATHS = ['/cgi-bin/rules/list2', '/cgi-bin/values/list2', '/cgi-bin/get-custom-certs-info'];
 var DONT_CHECK_PATHS = ['/cgi-bin/server-info', '/cgi-bin/plugins/is-enable', '/cgi-bin/plugins/get-plugins',
   '/preview.html', '/cgi-bin/rootca', '/cgi-bin/check-update', '/cgi-bin/log/set', '/cgi-bin/status'];
@@ -70,11 +71,14 @@ function isTempFile(query) {
   return common.getTempFile(query.filename);
 }
 
+function sendForbidden(res) {
+  res.setHeader('Content-Type', 'application/json; charset=utf-8');
+  res.end('{"ec":0,"value":"","forbidden":true}');
+}
+
 function sendToService(req, res) {
   if (!hasLogin() && req.path === '/cgi-bin/temp/get' && !isTempFile(req.query)) {
-    res.setHeader('Content-Type', 'application/json; charset=utf-8');
-    res.end('{"ec":0,"value":"","forbidden":true}');
-    return;
+    return sendForbidden(res);
   }
   loadService(function(err, options) {
     if (err) {
@@ -135,6 +139,9 @@ function requireLogin(req, res, msg) {
     }
     return res.status(404).end();
   }
+  if (req.path === IMPORT_CGI) {
+    return sendForbidden(res);
+  }
   res.setHeader('WWW-Authenticate', ' Basic realm=User Login');
   res.setHeader('Content-Type', 'text/html; charset=utf8');
   res.status(401).end(msg || 'Access denied, please <a href="javascript:;" onclick="location.reload()">try again</a>');
@@ -410,32 +417,7 @@ function cgiHandler(req, res) {
     handleResponse();
   });
 }
-app.get('/cgi-bin/import-remote', function(req, res) {
-  var url = req.query.url;
-  if (HTTP_RE.test(url)) {
-    util.request({
-      url: url,
-      maxLength: MAX_LEN
-    }, function(err, body, r) {
-      if (err) {
-        var msg = err.code === 'EEXCEED'  ? 'The size of response body exceeds 6MB' : err.message;
-        return res.json({ec: 2, em: msg});
-      }
-      var status = r.statusCode;
-      if (status !== 200) {
-        var em = status > 200 && status < 400 ? 'No data' : 'Request failed';
-        return res.json({ec: 2, em: em + ' (statusCode: ' + status + ')'});
-      }
-      return res.json({ec: 0, body: body});
-    });
-  } else if (util.isString(url)) {
-    req.url = '/cgi-bin/temp/get?filename=' + encodeURIComponent(url);
-    req.query.filename = url;
-    sendToService(req, res);
-  } else {
-    res.json({ec: 400, em: 'Bad url'});
-  }
-});
+
 app.all('/service/*', sendToService);
 app.all('/cgi-bin/service/*', sendToService);
 app.all('/cgi-bin/sessions/*', sendToService);
@@ -448,7 +430,7 @@ function readPluginPage(req, res, plugin, html, config) {
   res.write(config);
   res.write(html);
   var index = req.path.indexOf('/', 1);
-  if (index === -1) {
+  if (index === -1 || common.existsUpPath(req.path)) {
     res.end();
   } else {
     var filepath = req.path.substring(index + 1);
@@ -528,6 +510,33 @@ app.use(function(req, res, next) {
   }
 });
 
+app.get(IMPORT_CGI, function(req, res) {
+  var url = req.query.url;
+  if (HTTP_RE.test(url)) {
+    util.request({
+      url: url,
+      maxLength: MAX_LEN
+    }, function(err, body, r) {
+      if (err) {
+        var msg = err.code === 'EEXCEED'  ? 'The size of response body exceeds 6MB' : err.message;
+        return res.json({ec: 2, em: msg});
+      }
+      var status = r.statusCode;
+      if (status !== 200) {
+        var em = status > 200 && status < 400 ? 'No data' : 'Request failed';
+        return res.json({ec: 2, em: em + ' (statusCode: ' + status + ')'});
+      }
+      return res.json({ec: 0, body: body});
+    });
+  } else if (util.isString(url)) {
+    req.url = '/cgi-bin/temp/get?filename=' + encodeURIComponent(url);
+    req.query.filename = url;
+    sendToService(req, res);
+  } else {
+    res.json({ec: 400, em: 'Bad url'});
+  }
+});
+
 app.post('/cgi-bin/composer', function(req, res) {
   req.headers[config.CLIENT_IP_HEADER] = util.getClientIp(req);
   req.headers[config.CLIENT_PORT_HEADER] = util.getClientPort(req);

package/lib/config.js

@@ -26,7 +26,6 @@ var httpsAgents = new LRU({ max: 360 });
 var socksAgents = new LRU({ max: 100 });
 var version = process.version.substring(1).split('.');
 var disableAgent = version[0] > 10;
-var useVerbatim = version[0] >= 17;
 var hasIPv6First = version[0] >= 22 && version[1] >= 1;
 var hasDnsOrder = typeof dns.setDefaultResultOrder === 'function';
 var uid = Date.now().toString(16) + (process.pid * 10000 + Math.floor(Math.random() * 10000)).toString(16);
@@ -61,15 +60,10 @@ var variableProperties = [
   'disableInstaller'
 ];
 if (hasDnsOrder) {
-  if (hasIPv6First) {
-    config.verbatim = 2;
-  } else {
-    config.verbatim = 1;
-  }
+  config.verbatim = hasIPv6First ? 2 : 1;
 }
 
 config.appName = common.upperFirst(config.name);
-config.defaultDnsOrder = useVerbatim ? 1 : 2;
 config.uid = uid;
 config.rejectUnauthorized = false;
 config.enableH2 = version[0] > 12; // 支持 HTTP2 要求的最低 Node 版本
@@ -119,7 +113,7 @@ config.PLUGIN_HOOKS = {
 
 var KEEP_ALIVE_MSECS = 10000;
 var CONN_TIMEOUT = common.CONN_TIMEOUT;
-var DNS_ORDERS_OPTS = ['', 'verbatim', 'ipv4first', hasIPv6First ? 'ipv6first' : ''];
+var DNS_ORDERS_OPTS = ['', 'ipv4first', 'ipv4first', hasIPv6First ? 'ipv6first' : '', '', 'verbatim'];
 var DOMAIN_STAR_RE = /([*~]+)(\\.)?/g;
 
 config.CONN_TIMEOUT = CONN_TIMEOUT;
@@ -305,13 +299,16 @@ function getAuths(_url) {
 
 exports.getAuths = getAuths;
 
+function getDnsOrder(order) {
+  return order == 1 ? 2 : order;
+}
+
 function setDefaultResultOrder(order) {
   if (!hasDnsOrder) {
     return;
   }
-  order = DNS_ORDERS_OPTS.indexOf(order) === -1 ? DNS_ORDERS_OPTS[order] : order;
-  if (!order) {
-    return;
+  if (DNS_ORDERS_OPTS.indexOf(order) === -1) {
+    order = DNS_ORDERS_OPTS[order] || DNS_ORDERS_OPTS[1];
   }
   config.ipv4First = false;
   config.ipv6First = false;
@@ -321,10 +318,10 @@ function setDefaultResultOrder(order) {
     config.ipv4First = true;
   }
   try {
-    if (dns.getDefaultResultOrder() !== order) {
+    if (!dns.getDefaultResultOrder || dns.getDefaultResultOrder() !== order) {
       dns.setDefaultResultOrder(order);
     }
-    config.dnsOrder = DNS_ORDERS_OPTS.indexOf(order);
+    config.dnsOrder = getDnsOrder(DNS_ORDERS_OPTS.indexOf(order));
     return true;
   } catch (e) {}
 }

package/lib/handlers/file-proxy.js

@@ -157,7 +157,7 @@ function getRawResByPath(protocol, path, req, size, callback, body) {
       }
     });
     reader.on('error', response);
-    reader.on('end', response);
+    reader.once('end', response);
   } else {
     callback(reader, range, size);
   }

package/lib/https/ca.js

@@ -43,9 +43,9 @@ var ILEGAL_CHAR_RE = /[^a-z\d-]/i;
 // https://cloud.tencent.com/developer/ask/sof/58155
 var RANDOM_SERIAL = '/' + Date.now() + '/' + process.pid + '/' + Math.floor(Math.random() * 100);
 var ONE_DAY = 1000 * 60 * 60 * 24;
-var MIN_DATE = ONE_DAY * 20;
-var CLEAR_CERTS_INTERVAL = ONE_DAY * 20;
-var MAX_INNTERFAL = 16;
+var ONE_YEAR = ONE_DAY * 365;
+var MIN_DATE = ONE_DAY * 7;
+var MAX_DATE = ONE_DAY * 36;
 var PORT_RE = /:\d*$/;
 var pureCertFiles = {};
 var customRoot;
@@ -71,13 +71,16 @@ function resetAllCerts() {
 }
 
 // When delay is larger than 2147483647 or less than 1, the delay will be set to 1. Non-integer delays are truncated to an integer.
-var intervalCount = 0;
+var startTime = Date.now();
+var INTERVAL = ONE_DAY;
+var MAX_AGE = MAX_DATE - INTERVAL * 2;
 var timer = setInterval(function () {
-  if (++intervalCount >= MAX_INNTERFAL) {
-    intervalCount = 0;
+  var now = Date.now();
+  if (now - startTime >= MAX_AGE) {
+    startTime = now;
     resetAllCerts();
   }
-}, CLEAR_CERTS_INTERVAL);
+}, INTERVAL);
 
 if (timer && typeof timer.unref === 'function') {
   timer.unref();
@@ -553,18 +556,16 @@ function createCert(publicKey, serialNumber, isShortPeriod) {
   var cert = pki.createCertificate();
   cert.publicKey = publicKey;
   cert.serialNumber = serialNumber || '01';
-  var curDate = new Date();
-  var curYear = curDate.getFullYear();
+  var now = Date.now();
+  // https://www.ssls.com/blog/apples-new-ssl-lifetime-limitation-and-what-it-means-for-you/
+  // https://chromium.googlesource.com/chromium/src/+/refs/heads/master/net/cert/cert_verify_proc.cc#900
   if (isShortPeriod) {
-    cert.validity.notBefore = new Date(curDate.getTime() - MIN_DATE);
+    cert.validity.notBefore = new Date(now - MIN_DATE);
+    cert.validity.notAfter = new Date(now + MAX_DATE);
   } else {
-    cert.validity.notBefore = new Date();
-    cert.validity.notBefore.setFullYear(curYear - 1);
+    cert.validity.notBefore = new Date(now - ONE_YEAR);
+    cert.validity.notAfter = new Date(now + ONE_YEAR * 10);
   }
-  // https://www.ssls.com/blog/apples-new-ssl-lifetime-limitation-and-what-it-means-for-you/
-  // https://chromium.googlesource.com/chromium/src/+/refs/heads/master/net/cert/cert_verify_proc.cc#900
-  cert.validity.notAfter = new Date();
-  cert.validity.notAfter.setFullYear(curYear + (isShortPeriod ? 1 : 10));
   return cert;
 }
 

package/lib/https/h2.js

@@ -33,33 +33,43 @@ function onClose(stream, callback) {
   });
 }
 
+function closeClose(client, name) {
+  try {
+    client.close();
+  } catch (e) {}
+  delete clients[name];
+}
+
 setInterval(function () {
   var now = Date.now();
   Object.keys(clients).forEach(function (name) {
     var client = clients[name];
-    if (now - client._updateTime > CACHE_TIMEOUT) {
-      client.close();
-      delete clients[name];
+    if (isClosed(client) || now - client._updateTime > CACHE_TIMEOUT) {
+      closeClose(client, name);
     }
   });
 }, INTERVAL);
 
-function getKey(options) {
+function getOrigin(req) {
+  return (req.useHttpH2 ? 'http' : 'https') + '://' + req.headers.host;
+}
+
+function getKey(options, req) {
   var proxyOpts = options._proxyOptions;
   var proxyType = '';
   if (proxyOpts) {
-    var auth =
-      (proxyOpts.headers && proxyOpts.headers['proxy-authorization']) || '';
+    var headers = proxyOpts.headers || {};
     proxyType = [
       proxyOpts.proxyType,
       proxyOpts.proxyHost,
       proxyOpts.proxyPort,
-      proxyOpts.headers.host,
+      headers.host,
       proxyOpts.proxyTunnelPath || '',
-      auth
+      headers['proxy-authorization'] || ''
     ].join(':');
   }
   return [
+    getOrigin(req),
     options.servername,
     options.host,
     options.port || '',
@@ -222,35 +232,35 @@ function getSocket(options, callback, req) {
 }
 
 function getClient(req, socket, name, callback) {
-  var origin = (req.useHttpH2 ? 'http' : 'https') + '://' + req.headers.host;
   var handleCallback = function(err, clt) {
     if (callback) {
       clearTimeout(timer);
       if (err || !clt) {
-        delete clients[name];
+        closeClose(client, name);
         socket.destroy();
-        client.close();
       }
       callback(clt);
       callback = timer = null;
     }
   };
   var timer = setTimeout(handleCallback, REQ_TIMEOUT);
-  var client = http2.connect(
-    origin, util.setRejectUnauthorized(req, {
-      settings: H2_SETTINGS,
-      maxSessionMemory: MSM,
-      peerMaxConcurrentStreams: PMCS,
-      streamResetBurst: RESET_BURST,
-      streamResetRate: RESET_RATE,
-      createConnection: function () {
-        return socket;
-      }
-    }), function() {
-      handleCallback(null, client);
-    });
+  var client = http2.connect(getOrigin(req), util.setRejectUnauthorized(req, {
+    settings: H2_SETTINGS,
+    maxSessionMemory: MSM,
+    peerMaxConcurrentStreams: PMCS,
+    streamResetBurst: RESET_BURST,
+    streamResetRate: RESET_RATE,
+    createConnection: function () {
+      return socket;
+    }
+  }), function() {
+    handleCallback(null, client);
+  });
   clients[name] = client;
   client._updateTime = Date.now();
+  client.once('goaway', function() {
+    closeClose(client, name);
+  });
   onClose(client, handleCallback);
   onClose(socket, handleCallback);
   return client;
@@ -261,11 +271,6 @@ function requestH2(client, req, res, callback) {
     return;
   }
   var headers = util.formatH2Headers(req.headers);
-  delete req.headers.connection;
-  delete req.headers['keep-alive'];
-  delete req.headers['http2-settings'];
-  delete req.headers['proxy-connection'];
-  delete req.headers['transfer-encoding'];
   var options = req.options;
   var responsed;
   headers[':path'] = options.path;
@@ -327,8 +332,10 @@ function requestH2(client, req, res, callback) {
     });
     req.pipe(h2Session);
   } catch (e) {
-    !responsed && callback();
-    responsed = true;
+    if (!responsed) {
+      callback();
+      responsed = true;
+    }
   }
 }
 
@@ -380,12 +387,16 @@ function checkTlsError(err) {
   return typeof code === 'string' && (code.indexOf('ERR_TLS_') === 0 || code.indexOf('ERR_SSL_') === 0);
 }
 
+function isClosed(client) {
+  return client.destroyed || client.closed;
+}
+
 exports.request = function (req, res, callback) {
   var options = req.useH2 && req.options;
   if (!options || options.isPlugin || req._isInternalProxy) {
     return callback();
   }
-  var key = getKey(options);
+  var key = getKey(options, req);
   var reqId = req.disable.keepH2Session ? '' : req._h2ReqId;
   var name = (reqId || req.clientIp) + '\n' + key;
   var client = clients[name];
@@ -395,13 +406,21 @@ exports.request = function (req, res, callback) {
         name = name + '\n' + client.curIndex;
         client.curIndex = ++client.curIndex % CONCURRENT;
         client = clients[name];
+        if (client && isClosed(client)) {
+          delete clients[name];
+          client = null;
+        }
       } else {
         client.curIndex = 1;
       }
     }
     if (client) {
-      client._updateTime = Date.now();
-      return requestH2(client, req, res, callback);
+      if (!isClosed(client)) {
+        client._updateTime = Date.now();
+        return requestH2(client, req, res, callback);
+      }
+      delete clients[name];
+      client = null;
     }
   }
   var time = notH2.peek(key);

package/lib/https/index.js

@@ -1177,6 +1177,12 @@ module.exports = function (socket, next, isWebPort) {
     headersStr = chunk && chunk.toString();
     var isHttp = chunk && HTTP_RE.test(headersStr);
     var statusLine = isHttp && RegExp['$&'];
+    var handlePipe = function() {
+      reqSocket.on('error', destroy);
+      reqSocket.write(chunk);
+      reqSocket.pipe(socket).pipe(reqSocket);
+      socket.resume();
+    };
     if (isHttp && CONNECT_RE.test(RegExp.$1)) {
       chunk = addClientInfo(socket, chunk, statusLine, clientIp, clientPort);
       util.connect(
@@ -1189,10 +1195,7 @@ module.exports = function (socket, next, isWebPort) {
             if (err || socket._hasError) {
               return destroy(err);
             }
-            reqSocket.on('error', destroy);
-            reqSocket.write(chunk);
-            reqSocket.pipe(socket).pipe(reqSocket);
-            socket.resume();
+            handlePipe();
           }
         );
       return;
@@ -1248,12 +1251,10 @@ module.exports = function (socket, next, isWebPort) {
               if (err || socket._hasError) {
                 return destroy(err);
               }
-              reqSocket.on('error', destroy);
-              socket._w2TunnelKey = reqSocket.localPort + ':' + reqSocket.remotePort;
-              tunnelTmplData.set(socket._w2TunnelKey,  getTunnelData(socket, clientIp, clientPort, isHttpH2));
-              reqSocket.write(chunk);
-              reqSocket.pipe(socket).pipe(reqSocket);
-              socket.resume();
+              var key = reqSocket.localPort + ':' + reqSocket.remotePort;
+              socket._w2TunnelKey = key;
+              tunnelTmplData.set(key, getTunnelData(socket, clientIp, clientPort, isHttpH2));
+              handlePipe();
             }
           );
       };

package/lib/inspectors/data.js

@@ -419,7 +419,7 @@ function emitDataEvents(req, res, proxy) {
   }
 
   req.once('dest', function (_req) {
-    _req.once('finish', function () {
+    util.onWriteEnd(_req, function () {
       if (!requestTime) {
         setRequestTime(Date.now());
       }
@@ -441,15 +441,19 @@ function emitDataEvents(req, res, proxy) {
   req.once('error', handleError);
   res.once('error', handleError);
   res.once('close', handleError);
-  res.once('finish', setEndTime);
+  util.onWriteEnd(res, setEndTime);
 
   function handleError(err) {
     req._hasError = true;
     util.clearDelayTimer(req);
-    if (!data || endTime || data.endTime || (data.responseTime && !err)) {
+    if (!data || endTime || data.endTime) {
       return;
     }
+    // 触发 endTime
     !endTime && setEndTime();
+    if (data.responseTime && !err) {
+      return;
+    }
     delete data.abort;
     // 不能乱优化，跟 var msg = err && err.message; if (msg !== 'Aborted' && msg !== 'aborted') 不一样
     if (err && err.message !== 'Aborted' && err.message !== 'aborted') {

package/lib/inspectors/log.js

@@ -7,7 +7,6 @@ var logScriptFile = path.join(config.ASSESTS_PATH, 'js/log.js');
 var logScript = fs.readFileSync(logScriptFile, { encoding: 'utf8' });
 var logScriptTag = '<script>' + logScript + '</script>\r\n';
 var logHtmlScript = '<!DOCTYPE html>\r\n' + logScriptTag;
-var LOG_ID_RE = /^log:\/\/(\{[^\s]{1,36}\}|[^/\\{}()<>\s]{1,36})$/;
 
 function wrapScript(script, isHtml) {
   return isHtml
@@ -53,39 +52,21 @@ module.exports = function (req, res) {
         transform._transform = function (chunk, _, callback) {
           if (!added) {
             added = true;
-            var logId = '';
-            var isValue;
-            if (LOG_ID_RE.test(log.matcher)) {
-              logId = RegExp.$1;
-              if (logId[0] === '{') {
-                logId = logId.slice(1, -1);
-                isValue = true;
-              }
-              try {
-                logId = encodeURIComponent(logId);
-              } catch (e) {}
-            }
-            util.getRuleValue(
-              logId && !isValue ? null : log,
-              function (script) {
-                topScript = topScript.replace('$LOG_ID', logId);
-                var buf = [util.toBuffer(topScript)];
-                userScript = script || null;
-                if (userScript) {
-                  userScript = util.toBuffer(wrapScript(userScript, isHtml));
-                  if (isHtml || !chunk) {
-                    buf.push(userScript);
-                    userScript = null;
-                  }
+            var logId = util.removeProtocol(log.matcher, true);
+            util.getRuleValue(!logId || /^[^/\\{}()<>]+$/.test(logId) ? null : log, function (script) {
+              topScript = topScript.replace('$LOG_ID', logId && util.encodeURIComponent(logId));
+              var buf = [util.toBuffer(topScript)];
+              userScript = script || null;
+              if (userScript) {
+                userScript = util.toBuffer(wrapScript(userScript, isHtml));
+                if (isHtml || !chunk) {
+                  buf.push(userScript);
+                  userScript = null;
                 }
-                chunk && buf.push(chunk);
-                callback(null, Buffer.concat(buf));
-              },
-              null,
-              null,
-              null,
-              req
-            );
+              }
+              chunk && buf.push(chunk);
+              callback(null, Buffer.concat(buf));
+            }, null, null, null, req);
           } else {
             callback(null, chunk || userScript);
           }

package/lib/inspectors/res.js

@@ -798,7 +798,7 @@ module.exports = function (req, res, next) {
     var useFrames;
     res.headers = req.resHeaders = headers;
     res._originEncoding = headers['content-encoding'];
-    req.statusCode = _res.statusCode;
+    req.statusCode = res.statusCode = _res.statusCode;
     if (_res.rawHeaderNames) {
       res.rawHeaderNames = _res.rawHeaderNames;
     } else {
@@ -1243,7 +1243,7 @@ module.exports = function (req, res, next) {
                               _res.statusCode,
                               formatHeaders(curHeaders, rawNames)
                             );
-                            util.onResEnd(_res, function () {
+                            util.onReadEnd(_res, function () {
                               var trailers = _res.trailers;
                               if (
                                 !res.chunkedEncoding ||

package/lib/inspectors/rules.js

@@ -61,6 +61,15 @@ function setupRules(req, next) {
   });
 }
 
+function handleCodec(socket, enTrans, deTrans, handleError) {
+  enTrans.on('error', handleError);
+  deTrans.on('error', handleError);
+  deTrans.once('end', function() {
+    util.endSocket(socket);
+  });
+  enTrans.pipe(socket).pipe(deTrans);
+}
+
 function getDecoder(obj) {
   return function (socket, callback) {
     var encoding = obj._originEncoding;
@@ -97,9 +106,7 @@ function getDecoder(obj) {
         delete obj.headers['content-length'];
         var enTrans = getEncodeTransform();
         var deTrans = getDecodeTransform();
-        enTrans.pipe(socket).pipe(deTrans);
-        enTrans.on('error', handleError);
-        deTrans.on('error', handleError);
+        handleCodec(socket, enTrans, deTrans, handleError);
         if (decoder) {
           decoder.pipe(enTrans);
         } else {
@@ -127,9 +134,7 @@ function getEncoder(obj, req) {
       delete obj.headers['content-length'];
       var enTrans = getEncodeTransform();
       var deTrans = getDecodeTransform();
-      enTrans.on('error', handleError);
-      deTrans.on('error', handleError);
-      enTrans.pipe(socket).pipe(deTrans);
+      handleCodec(socket, enTrans, deTrans, handleError);
       socket = enTrans;
       if (encoder) {
         deTrans.pipe(encoder);

package/lib/inspectors/weinre.js

@@ -36,7 +36,7 @@ module.exports = function (req, res) {
       }
       !util.isEnable(req, 'keepAllCSP') && util.disableCSP(_res.headers);
       !req._customCache && util.disableResStore(_res.headers);
-      var name = util.getPath(util.rule.getMatcher(weinre));
+      var name = util.removeProtocol(weinre.matcher, true);
       var transform = new Transform();
       transform._transform = function (chunk, _, callback) {
         if (!chunk) {